VAR-201509-0303
Vulnerability from variot - Updated: 2023-12-18 12:06Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Symantec Web Gateway is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201509-0303",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "web gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "symantec",
"version": "5.2.2"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.9,
"vendor": "symantec",
"version": "5.2.2"
},
{
"model": "web gateway",
"scope": "lt",
"trust": 0.8,
"vendor": "symantec",
"version": "5.2.2 db 5.0.0.1277"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.2.1"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.2"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.1.1"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.1.0"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.3.18"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.3.17"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.3"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.2.18"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.2"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0.1"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "5.0"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "4.5.0.376"
},
{
"model": "web gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "symantec",
"version": "4.5"
},
{
"model": "web gateway db update",
"scope": "ne",
"trust": 0.3,
"vendor": "symantec",
"version": "5.2.25.0."
}
],
"sources": [
{
"db": "BID",
"id": "76729"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.2.2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6548"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Jensen working with Security-Assessment.com",
"sources": [
{
"db": "BID",
"id": "76729"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
],
"trust": 0.9
},
"cve": "CVE-2015-6548",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "MULTIPLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.4,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Multiple",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2015-6548",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "MULTIPLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.4,
"id": "VHN-84509",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:M/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-6548",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201509-251",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-84509",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-84509"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Symantec Web Gateway is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. \nExploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Symantec Web Gateway (SWG) is a set of network content filtering software developed by Symantec Corporation of the United States. The software provides web content filtering, data loss prevention, and more. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "BID",
"id": "76729"
},
{
"db": "VULHUB",
"id": "VHN-84509"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-6548",
"trust": 2.8
},
{
"db": "BID",
"id": "76729",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1033625",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-84509",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-84509"
},
{
"db": "BID",
"id": "76729"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"id": "VAR-201509-0303",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-84509"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:06:54.546000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SYM15-009",
"trust": 0.8,
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=\u0026suid=20150916_00"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-84509"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=\u0026suid=20150916_00"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/76729"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id/1033625"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6548"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6548"
},
{
"trust": 0.3,
"url": "http://www.symantec.com"
},
{
"trust": 0.3,
"url": "http://www.symantec.com/business/web-gateway"
},
{
"trust": 0.1,
"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026amp;pvid=security_advisory\u0026amp;year=\u0026amp;suid=20150916_00"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-84509"
},
{
"db": "BID",
"id": "76729"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-84509"
},
{
"db": "BID",
"id": "76729"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-09-20T00:00:00",
"db": "VULHUB",
"id": "VHN-84509"
},
{
"date": "2015-09-16T00:00:00",
"db": "BID",
"id": "76729"
},
{
"date": "2015-09-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"date": "2015-09-20T20:59:10.477000",
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"date": "2015-09-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-22T00:00:00",
"db": "VULHUB",
"id": "VHN-84509"
},
{
"date": "2015-09-16T00:00:00",
"db": "BID",
"id": "76729"
},
{
"date": "2015-09-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-004902"
},
{
"date": "2016-12-22T03:00:13.527000",
"db": "NVD",
"id": "CVE-2015-6548"
},
{
"date": "2015-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Symantec Web Gateway Management console running on the appliance software PHP In the script SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-004902"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201509-251"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…